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before  the  Subcommittee  on  Federal  Financial 
Management,  Government  Information, 

Federal  Services,  and  International  Security, 
Committee  on  Homeland  Security  and 
Governmental  Affairs,  U.S.  Senate 

Why  GAO  Did  This  Study 

The  Department  of  Defense  (DOD)  has 
initiated  several  efforts  over  the  years 
to  address  its  long-standing  financial 
management  weaknesses  and 
ultimately  achieve  unqualified  (clean) 
opinions  on  its  financial  statements.  In 
2005,  the  DOD  Comptroller  first  issued 
the  Financial  Improvement  and  Audit 
Readiness  (FIAR)  Plan  for  improving 
financial  management  and  reporting. 

In  May  2010,  the  DOD  Comptroller 
issued  the  FIAR  Guidance  to  provide 
standardized  guidance  to  DOD 
components  for  developing  Financial 
Improvement  Plans  (FIP)  to  implement 
the  FIAR  Plan. 

GAO’s  testimony  focuses  on 
(1 )  progress  made  by  the  DOD 
Comptroller  in  developing  and  issuing 
the  FIAR  Guidance,  (2)  challenges 
faced  by  DOD  components  in 
implementing  the  FIAR  Guidance,  and 
(3)  improvements  needed  in  DOD’s 
oversight  and  monitoring  of  FIAR 
implementation  efforts. 

This  statement  is  based  on  four  audits 
that  were  undertaken  at  the  request  of 
this  subcommittee  and  other 
congressional  requesters  to  evaluate 
the  progress  DOD  is  making  in 
implementing  its  FIAR  Plan  and  FIAR 
Guidance.  GAO  addresses  findings 
and  recommendations  from  two  reports 
being  issued  this  week  (GAO-1 1-830 
and  GAO-1 1-851)  and  preliminary 
information  from  two  ongoing  audits. 
Each  audit  demonstrates  some  of  the 
challenges  DOD  faces  in  improving  its 
financial  management  and  achieving 
the  goal  of  auditable  financial 
statements  by  2017. 


View  GAO-1 1-932T.  For  more  information, 
contact  Asif  A.  Khan  at  (202)  512-9869  or 
khana@gao.gov. 


DOD  FINANCIAL  MANAGEMENT 

Ongoing  Challenges  in  Implementing  the  Financial 
Improvement  and  Audit  Readiness  Plan 


What  GAO  Found 

In  a  report  issued  this  week,  GAO  concluded  that  the  FIAR  Guidance  provides  a 
reasonable  methodology  for  the  DOD  components  to  follow  in  developing  and 
implementing  their  FIPs.  It  details  the  roles  and  responsibilities  of  the  DOD 
components,  and  prescribes  a  standard,  systematic  process  components  should 
follow  to  assess  processes,  controls,  and  systems,  and  identify  and  correct 
weaknesses  in  order  to  achieve  auditability.  The  FIAR  Guidance  also  requires 
the  components  to  prepare  and  implement  corrective  action  plans  for  resolving 
the  deficiencies  identified  during  testing  and  to  document  the  results,  which  is 
consistent  with  federal  internal  control  standards  and  related  guidance. 

DOD’s  ability  to  achieve  audit  readiness  is  dependent  on  the  components’  ability 
to  effectively  develop  and  implement  FIPs  in  compliance  with  the  FIAR 
Guidance.  However,  GAO’s  review  of  various  DOD  component  efforts  to  achieve 
audit  readiness  found  that  the  components  experienced  challenges  in 
implementing  the  FIAR  Guidance.  Specifically: 

•  The  Navy  and  the  Air  Force  had  not  adequately  developed  the  two  FIPs  that 
GAO  reviewed  in  accordance  with  the  FIAR  Guidance.  As  a  result,  they  did 
not  conduct  sufficient  control  and  substantive  testing,  and  reached 
conclusions  that  were  not  supported  by  the  testing  results. 

•  Auditors  of  the  Marine  Corps’  Statement  of  Budgetary  Resources  (SBR) 
issued  a  disclaimer  of  opinion  because  the  Marine  Corps  did  not  provide 
timely  and  relevant  supporting  documentation  for  accounting  transactions 
and  also  reported  that  internal  control  weaknesses  should  be  addressed. 

•  GAO’s  preliminary  work  on  the  Navy’s  and  Marine  Corps’  Fund  Balance  with 
Treasury  (FBWT)  reconciliation  processes  identified  issues  with  their  ability 
to  reconcile  FBWT — a  key  step  in  preparing  the  SBR. 

•  Based  on  preliminary  results,  GAO  identified  issues  in  the  implementation  of 
two  enterprise  resource  planning  (ERP)  systems  by  the  Army  and  the  Air 
Force.  DOD  has  acknowledged  that  effective  implementation  of  integrated 
systems  is  crucial  to  achieving  departmentwide  audit  readiness. 

Although  DOD  and  its  military  components  had  established  organizational 
structures  for  monitoring  and  oversight  of  audit  readiness  efforts,  GAO  found  that 
oversight  responsibilities  were  not  effectively  carried  out,  resulting  in  the 
ineffective  implementation  of  FIPs  and  unsupported  conclusions  of  audit 
readiness.  For  the  two  FIPs  that  GAO  reviewed,  neither  the  designated  officials 
nor  the  executive  committees  took  sufficient  action  to  ensure  that  the  FIPs 
complied  with  the  FIAR  Guidance.  Effective  oversight  would  also  help  ensure 
that  lessons  learned  from  recent  efforts  would  be  disseminated  throughout  the 
department  so  that  others  could  avoid  similar  problems.  For  example,  the  Marine 
Corps’  SBR  audit  effort  provide  valuable  lessons  that,  if  effectively  communicated 
and  implemented,  can  provide  a  roadmap  to  help  other  DOD  components 
achieve  audit  readiness.  GAO  recommends  actions  for  components  to  comply 
with  the  FIAR  Guidance,  for  the  Marine  Corps  to  develop  appropriate  corrective 
action  plans,  and  for  DOD  to  ensure  that  the  services  consider  lessons  learned. 
DOD  concurred  with  GAO’s  recommendations  related  to  implementing  the 
component  FIPs  and  with  three  of  four  recommendations  related  to  the  Marine 
Corps  SBR.  Further  details  on  DOD’s  comments  can  be  found  in  GAO’s  reports. 

_ United  States  Government  Accountability  Office 


Chairman  Carper,  Ranking  Member  Brown,  and  Members  of  the 
Subcommittee: 

It  is  a  pleasure  to  be  here  today  to  discuss  the  status  of  the  Department 
of  Defense’s  (DOD)  efforts  to  implement  its  Financial  Improvement  and 
Audit  Readiness  (FIAR)  Plan  to  improve  its  financial  management 
operations.  Given  the  federal  government’s  fiscal  challenges,  there  is  a 
significant  need  for  transparency  and  for  the  Congress,  the 
administration,  and  federal  managers  to  have  reliable,  useful,  and  timely 
financial  and  performance  information,  particularly  for  the  government’s 
largest  department.  For  more  than  a  decade,  DOD  has  been  on  GAO’s 
list  of  federal  programs  and  operations  at  high  risk  of  being  vulnerable  to 
fraud,  waste,  and  abuse.1  Despite  several  reform  initiatives,  DOD’s 
financial  management  remains  on  GAO’s  high-risk  list  today.  Long¬ 
standing  and  pervasive  weaknesses  in  DOD’s  financial  management  and 
related  business  processes  and  systems  have  (1)  resulted  in  a  lack  of 
reliable  information  needed  to  make  sound  decisions  and  report  on  the 
financial  status  and  cost  of  DOD  activities  to  Congress  and  DOD  decision 
makers;  (2)  adversely  affected  its  operational  efficiency  and  mission 
performance  in  areas  of  major  weapons  system  support  and  logistics;  and 
(3)  left  the  department  vulnerable  to  fraud,  waste,  and  abuse.  In  addition, 
these  long-standing  financial  management  weaknesses  have  precluded 
DOD  from  being  able  to  successfully  undergo  the  scrutiny  of  a  financial 
statement  audit.2  The  National  Defense  Authorization  Act  (NDAA)  for 
Fiscal  Year  2010  mandated  that  DOD  be  prepared  to  validate  (certify) 


^OD  bears  responsibility,  in  whole  or  in  part,  for  14  of  the  30  federal  programs  or 
activities  that  GAO  has  identified  as  being  at  high  risk  of  waste,  fraud,  abuse,  and 
mismanagement.  The  seven  specific  DOD  high-risk  areas  are  (1)  approach  to  business 
transformation,  (2)  business  systems  modernization,  (3)  contract  management,  (4) 
financial  management,  (5)  supply  chain  management,  (6)  support  infrastructure 
management,  and  (7)  weapon  systems  acquisition.  The  seven  governmentwide  high-risk 
areas  that  include  DOD  are:  (1)  disability  programs,  (2)  interagency  contracting,  (3) 
information  systems  and  critical  infrastructure,  (4)  information  sharing  for  homeland 
security,  (5)  human  capital,  (6)  real  property,  and  (7)  ensuring  the  effective  protection  of 
technologies  critical  to  U.S.  national  security  interests. 

2DOD’s  auditors  have  reported  material  financial  management  weaknesses  in  the 
following  areas:  (1)  Financial  Management  Systems,  (2)  Fund  Balance  with  Treasury,  (3) 
Accounts  Receivable,  (4)  Inventory,  (5)  Operating  Materials  and  Supplies,  (6)  General 
Property,  Plant,  and  Equipment,  (7)  Government-Furnished  Material  and  Contractor- 
Acquired  Material,  (8)  Accounts  Payable,  (9)  Environmental  Liabilities,  (10)  Statement  of 
Net  Cost,  (11)  Intragovernmental  Eliminations,  (12)  Other  Accounting  Entries,  and  (13) 
Reconciliation  of  Net  Cost  of  Operations  to  Budget. 
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that  its  consolidated  financial  statements  are  ready  for  audit  by 
September  30,  201 7. 3 

In  2005,  the  DOD  Comptroller  established  the  DOD  Financial 
Improvement  and  Audit  Readiness  (FIAR)  Directorate  to  develop, 
manage,  and  implement  a  strategic  approach  for  addressing  the 
department’s  financial  management  weaknesses  and  for  achieving 
auditability,  and  to  integrate  those  efforts  with  other  improvement 
activities,  such  as  the  department’s  business  system  modernization 
efforts.  Also  in  2005,  the  DOD  Comptroller  first  issued  the  FIAR  Plan  for 
improving  financial  management  and  reporting.  The  NDAA  for  Fiscal  Year 
2010  mandated  that  the  FIAR  Plan  include  the  specific  actions  to  be 
taken  to  correct  the  financial  management  deficiencies  that  impair  the 
department’s  ability  to  prepare  timely,  reliable,  and  complete  financial 
management  information.  In  May  2010,  the  DOD  Comptroller  issued  the 
FIAR  Guidance  to  provide  standardized  guidance  to  DOD  components  for 
developing  Financial  Improvement  Plans  (FIP)  to  implement  the  FIAR 
Plan.  In  September  2010,  we  reported  that  the  department  needed  to 
focus  on  implementing  its  FIAR  Plan  and  that  the  key  to  successful 
implementation  would  be  the  efforts  of  the  DOD  military  components  and 
the  quality  of  their  individual  FIPs.4 

My  testimony  today  will  focus  on  three  key  issues: 

(1)  progress  made  by  the  DOD  Comptroller  in  developing  and 
issuing  the  FIAR  Guidance  to  assist  DOD  components  in 
implementing  the  FIAR  Plan; 

(2)  challenges  in  the  implementation  of  the  FIAR  Guidance  at  the 
Navy,  Air  Force,  and  Marine  Corps;  and 

(3)  improvements  needed  in  DOD’s  oversight  and  monitoring  of 
FIAR  implementation  efforts. 

My  statement  is  based  on  four  audits  that  we  have  undertaken  at  the 
request  of  this  subcommittee  and  other  congressional  requesters  to 


3Pub.  L.  No.  111-84,  div.  A,  §  1003(a),  (b),  123  Stat.  2190,  2439-40  (Oct.  28,  2009). 

4GAO,  Department  of  Defense:  Financial  Management  Improvement  and  Audit  Readiness 
Efforts  Continue  to  Evolve,  GAO-1 0-1 059T  (Washington,  D.C.:  Sept.  29,  2010). 
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evaluate  the  progress  DOD  is  making  in  implementing  its  FIAR  Plan  and 
related  Guidance.  Two  of  the  reports  have  been  issued  this  week,5  and 
we  are  addressing  preliminary  findings  for  the  other  two  reports,  which 
are  in  process.  Each  report  demonstrates  some  of  the  challenges  DOD 
faces  in  improving  its  financial  management,  including  its  ability  to 
achieve  the  goal  of  reliable  financial  information  and  auditable  financial 
statements  by  2017: 

•  The  first  report  discusses  the  methodology  reflected  in  DOD’s  FIAR 
Guidance,  whether  selected  military  component  FIPs  adhered  to  the 
FIAR  Guidance,  and  DOD’s  oversight  and  monitoring  of  the  FIP 
process.6  The  published  report  includes  details  on  the  scope  and 
methodology  for  this  review. 

•  The  second  report  addresses  why  auditors  were  unable  to  complete 
an  audit  of  one  of  DOD’s  financial  statements,  the  Statement  of 
Budgetary  Resources  (SBR),  for  one  military  service,  the  U.S.  Marine 
Corps.7  This  report  also  includes  details  on  the  scope  and 
methodology  for  this  review. 

•  The  remaining  two  ongoing  audits  address  (1 )  a  key  process  for 
DOD’s  components — the  Fund  Balance  with  Treasury  (FBWT) 
reconciliation — which  illustrates  one  of  many  of  the  department’s 
challenges  and  (2)  the  implementation  of  comprehensive,  integrated 
business  systems  called  enterprise  resource  planning  (ERP) 
systems,8  which  DOD  considers  a  key  element  to  improving  financial 
management  and  achieving  auditability.  We  discussed  with  DOD 
officials  the  preliminary  findings  from  these  two  ongoing  audits  that 
are  included  in  this  testimony  and  considered  their  comments  in  this 
statement.  We  plan  to  issue  these  reports  in  October  2011. 


5GAO,  DOD  Financial  Management:  Improvement  Needed  in  DOD  Components’ 
Implementation  of  Audit  Readiness  Efforts,  GAO-11-851  (Washington,  D.C.:  Sept.  13, 
2011);  and  DOD  Financial  Management:  Marine  Corps  Statement  of  Budgetary 
Resources  Audit  Results  and  Lessons  Learned,  GAO-1 1-830  (Washington,  D.C.:  Sept. 
15,2011). 

6GAO-1 1-851. 

7GAO-1 1-830. 

8An  ERP  solution  is  an  automated  system  using  commercial  off-the-shelf  (COTS)  software 
consisting  of  multiple,  integrated  functional  modules  that  perform  a  variety  of  business- 
related  tasks,  such  as  general  ledger  accounting,  payroll,  and  supply  chain  management. 
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For  our  work  on  the  FBWT  reconciliation,  we  analyzed  Navy  and  Marine 
Corps  policies  and  procedures  covering  the  various  FBWT  reconciliation 
steps,  and  met  with  Navy,  Marine  Corps,  and  Defense  Finance  and 
Accounting  Service  (DFAS)  officials,  and  performed  walkthroughs  of  the 
Navy  and  Marine  Corps  FBWT  processes.  For  our  work  on  ERP  systems, 
we  focused  on  the  status  of  two  systems  by  reviewing  the  Army  and  Air 
Force  Test  and  Evaluation  Commands’  reports  on  the  systems  and 
interviewing  various  DOD  officials,  including  system  users  at  DFAS. 

Our  work  was  conducted  in  accordance  with  generally  accepted 
government  auditing  standards.  Those  standards  require  that  we  plan 
and  perform  the  audit  to  obtain  sufficient,  appropriate  evidence  to  provide 
a  reasonable  basis  for  our  findings  and  conclusions  based  on  our  audit 
objectives.  We  believe  the  evidence  obtained  provides  a  reasonable 
basis  for  our  findings  and  conclusions  based  on  our  audit  objectives. 


Background 


Over  the  years,  DOD  has  initiated  several  broad-based  reform  efforts  to 
address  its  long-standing  financial  management  weaknesses.  However, 
as  we  have  reported,  those  efforts  did  not  achieve  their  intended  purpose 
of  improving  the  department’s  financial  management  operations.9  The 
FIAR  Plan,  which  was  first  prepared  in  2005,  is  DOD’s  strategic  plan  and 
management  tool  for  guiding,  monitoring,  and  reporting  on  the 
department’s  financial  management  improvement  efforts.  As  such,  the 
plan  contains  an  incremental  approach  for  addressing  the  department’s 
financial  management  weaknesses  and  achieving  financial  statement 
auditability.  The  plan  focuses  on  three  goals:  (1)  achieve  and  sustain 
assurance  on  the  effectiveness  of  internal  controls,  (2)  develop  and 
implement  financial  management  systems  that  support  effective  financial 
management,  and  (3)  achieve  and  sustain  financial  statement  audit 
readiness. 

In  August  2009,  the  DOD  Comptroller  sought  to  focus  efforts  of  the 
department  and  components,  in  order  to  achieve  certain  short-  and  long- 


9GAO,  Financial  Management:  Achieving  Financial  Statement  Auditability  in  the 
Department  of  Defense,  GAO-09-373  (Washington,  D.C.:  May  6,  2009);  DOD  Financial 
Management:  Integrated  Approach ,  Accountability,  Transparency,  and  Incentives  Are 
Keys  to  Effective  Reform,  GAO-02-537T  (Washington,  D.C.:  Mar.  20,  2002);  Defense 
Management:  Actions  Needed  to  Sustain  Reform  Initiatives  and  Achieve  Greater  Results, 
GAO/NSI AD-00-72  (Washington,  D.C.:  July  25,  2000). 
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term  results,  by  giving  priority  to  improving  processes  and  controls  that 
support  the  financial  information  most  often  used  to  manage  the 
department.  Accordingly,  DOD  revised  its  FIAR  strategy  and  methodology 
to  focus  on  the  DOD  Comptroller’s  two  priorities — budgetary  information 
and  asset  accountability.  The  first  priority  is  to  strengthen  processes, 
controls,  and  systems  that  produce  DOD’s  budgetary  information  and  the 
department’s  SBRs.  The  second  priority  is  to  improve  the  accuracy  and 
reliability  of  management  information  pertaining  to  the  department’s 
mission-critical  assets,  including  military  equipment,  real  property,  and 
general  equipment.  The  DOD  Comptroller  directed  the  DOD 
components — including  the  Departments  of  the  Army,  Navy,  and  Air 
Force  and  the  Defense  Logistics  Agency — to  use  a  standard  process  to 
implement  the  FIAR  Plan  and  aggressively  modify  their  activities  to 
support  and  emphasize  achievement  of  the  priorities. 

In  May  2010,  DOD  issued  a  revised  FIAR  Plan  in  which  it  introduced  a 
new  phased  approach  toward  achieving  financial  statement  auditability. 
This  approach  consists  of  five  waves  (or  phases)  of  concerted 
improvement  activities.  The  first  two  waves  involve  budgetary 
information — appropriations  received10  and  the  SBR.  According  to  DOD, 
the  components’  implementation  of  the  methodology  described  in  the  May 
2010  FIAR  Plan  is  essential  to  the  success  of  the  department’s  efforts  to 
ultimately  achieve  full  financial  statement  auditability.* 11 


i  n 

‘Appropriations  received”  is  an  element  of  the  SBR  that  represents  appropriated  funds 
made  available  for  use  by  DOD  components. 

11  As  we  have  reported  (GAO-1 1-851),  the  department  has  not  yet  fully  defined  its  strategy 
for  completing  all  actions  necessary  to  achieve  the  FIAR  goals,  including  actions  related  to 
the  auditability  of  most  of  the  department’s  consolidated  financial  statements  such  as  the 
Balance  Sheet  and  the  Statement  of  Net  Cost,  and  significant  audit  areas  such  as 
equipment  valuation. 
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DOD’s  FIAR  Guidance 
Provides  a 
Reasonable 
Methodology 


Consistent  with  prior  GAO  recommendations12  and  the  NDAA  for  Fiscal 
Year  2010,  DOD  issued  the  FIAR  Guidance  in  May  2010,  which  details 
the  methodology  for  components  to  follow  in  order  to  achieve  financial 
management  improvements  and  auditability.  The  FIAR  Guidance  requires 
components  to  identify  and  prioritize  their  processes  into  assessable 
units.13  For  each  assessable  unit,  a  component  is  required  to  prepare  a 
FIP  in  accordance  with  the  steps  outlined  in  the  FIAR  Guidance.  For 
example,  civilian  and  military  pay  are  two  assessable  units  for  which  each 
DOD  component,  such  as  the  Army,  Navy,  and  Air  Force,  must  develop 
and  implement  plans  in  accordance  with  the  FIAR  Guidance  to  ensure 
that  their  civilian  and  military  pay  can  be  audited.  The  steps  required  for 
these  plans  include  assessing  processes,  controls,  and  systems; 
identifying  and  correcting  weaknesses;  assessing,  validating,  and 
sustaining  corrective  actions;  and  ultimately  achieving  audit  readiness. 
After  a  component  completes  its  evaluation  of  the  effectiveness  of 
corrective  actions  for  each  assessable  unit,  it  must  determine  whether 
each  assessable  unit  is  ready  for  audit.  For  example,  the  Air  Force,  based 
on  its  implementation  of  the  FIAR  Guidance  and  its  FIP,  planned  to 
conclude  during  fiscal  year  201 1  whether  or  not  its  FBWT  Reconciliation 
is  reliable  and  ready  for  audit.  Once  a  component’s  management 
determines  that  an  assessable  unit  is  ready  for  audit,  the  DOD 
Comptroller  and  DOD  Inspector  General  (IG)  must  review  the  related  FIP 
documentation  to  determine  if  they  agree  with  management’s  conclusion 
of  audit  readiness. 

In  our  report  issued  this  week,  we  concluded  that  the  FIAR  Guidance 
provides  a  reasonable  methodology  for  the  DOD  components  to  follow  in 
developing  and  implementing  their  FIPs.14  However,  as  described  later  in 
this  statement,  we  found  that  implementation  of  the  FIAR  Guidance  for 
the  two  assessable  units  we  reviewed  was  not  effective.  The  FIAR 
Guidance  details  the  roles  and  responsibilities  of  the  DOD  components, 
and  prescribes  a  standard,  systematic  process  that  components  should 
follow  to  assess  processes,  controls,  and  systems,  and  identify  and 
correct  weaknesses  in  order  to  achieve  auditability  for  each  of  their 


12GAO-09-373. 

13An  assessable  unit  can  be  any  part  of  the  financial  statements,  such  as  a  line  item  or  a 
class  of  assets  (e.g.,  civilian  pay  or  military  equipment),  a  class  of  transactions,  or  it  can 
be  a  process  or  a  system  that  helps  produce  the  financial  statements. 

14GAO-1 1-851. 
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assessable  units.  Overall,  the  procedures  required  by  the  FIAR  Guidance 
are  consistent  with  selected  procedures  for  conducting  financial 
statement  audits,  which  include  the  following: 

•  Conducting  internal  control  and  substantive  testing.  Internal 
control  testing  focuses  on  assessing  the  effectiveness  of  controls  that 
would  prevent  or  detect  potential  misstatements  in  the  financial 
statements.  Substantive  tests  are  performed  to  obtain  evidence  on 
whether  amounts  reported  on  the  financial  statements  are  reliable. 

•  Reconciling  the  population  of  transactions  to  be  tested.  To 

conduct  internal  control  and  substantive  testing,  a  sample  of  the  data 
transactions  is  typically  selected  fortesting.  An  organization  must  be 
able  to  identify  the  complete  population  of  transactions  so  that  a 
sample  can  be  selected  and  tested. 

•  Conducting  tests  of  information  systems  controls.  The 

components  are  required  to  identify,  document,  and  test  both  general 
and  application  controls  for  key  systems  that  process  transactions. 
General  controls15  are  the  policies  and  procedures  that  apply  to  all  or 
a  large  segment  of  an  entity’s  information  systems  and  help  ensure 
their  proper  operation.  Application  controls,  sometimes  referred  to  as 
business  controls,  are  incorporated  directly  into  computer  applications 
to  help  ensure  the  validity,  completeness,  accuracy,  and 
confidentiality  of  data  during  application  processing  and  reporting. 

The  FIAR  Guidance  also  requires  the  components  to  prepare  and 
implement  corrective  action  plans  for  resolving  the  deficiencies  identified 
during  testing  and  to  document  the  results,  which  is  consistent  with 
federal  internal  control  standards  and  Office  of  Management  and  Budget 
(OMB)  guidance.16 


15The  objectives  of  general  controls  include  safeguarding  data,  protecting  application 
programs,  and  ensuring  continued  computer  operations  in  case  of  unexpected 
interruptions. 

16GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD-OO-21.3.1 
(Washington,  D.C.:  November  1999);  and  OMB  Circular  No.  A-123,  Appendix  A,  Internal 
Control  Over  Financial  Reporting. 
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Challenges  for  DOD 
Components’ 
Implementation  of 
FIAR  Guidance 


Although  the  FIAR  Guidance  provides  a  reasonable  methodology  for 
improving  financial  management  within  the  department,  DOD’s  ability  to 
achieve  audit  readiness  is  highly  dependent  on  the  components’  ability  to 
effectively  develop  and  implement  FIPs  in  compliance  with  the  FIAR 
Guidance.  Our  reviews  of  various  DOD  component  efforts  to  achieve 
audit  readiness  found  that  the  components  faced  challenges  in  effectively 
implementing  the  FIAR  Guidance,  resulting  in  unsupported  conclusions  of 
audit  readiness  for  Navy  Civilian  Pay,  Air  Force  Military  Equipment,  and 
the  Marine  Corps  SBR.  Our  preliminary  work  also  found  that  a  key 
element  of  basic  financial  management — reconciling  the  FBWT  account — 
was  not  being  done  properly  on  a  regular  basis  and  the  weaknesses  were 
not  properly  identified  or  corrected  by  the  Navy  or  the  Marine  Corps. 
Finally,  to  achieve  fundamental  improvements  in  financial  management, 
DOD  recognizes  the  importance  of  transforming  its  business  operations 
through  the  implementation  of  ERP  systems.  Our  preliminary  work  on  two 
key  ERPs  that  have  been  partially  deployed  found  significant  issues  in 
both  systems. 


FIPs  for  Navy  Civilian  Pay 
and  Air  Force  Military 
Equipment  Were 
Incomplete  and  Ineffective 

•  The  Navy  and  Air  Force  did  not  conduct  sufficient  control  and 
substantive  testing,  and  contained  unsupportable  conclusions  that  the 
amounts  being  reported  for  Navy  Civilian  Pay  and  Air  Force  Military 
Equipment  were  reliable. 

•  The  Navy  and  Air  Force  did  not  complete  reconciliations  of  the 
population  of  transactions.  As  a  result,  the  components  could  not 
ensure  that  their  testing  results  could  be  projected  to  the  populations 
of  Navy  civilian  pay  transactions  and  Air  Force  military  equipment. 

•  The  Navy  and  Air  Force  did  not  fully  test  information  systems  controls. 
The  Navy’s  system  testing  did  not  include  essential  areas  such  as 
periodic  reviews  of  user  access  authorizations  and  logs  of  changes  to 
security  access  authorizations.  The  Air  Force’s  FIP  did  not  include 


Our  review  of  the  FIPs  for  Navy  Civilian  Pay  and  Air  Force  Military 
Equipment  found  that  neither  FIP  complied  with  the  FIAR  Guidance  and 
contained  unsupportable  conclusions.17  We  found  similar  deficiencies  in 
both  FIPs,  which  included  the  following: 


17GAO-1 1-851. 
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any  documentation  of  control  testing  for  the  two  systems  that  maintain 
its  military  equipment  data. 

•  The  Navy  and  Air  Force  did  not  fully  develop  and  implement 

corrective  action  plans  to  address  deficiencies  they  identified  during 
testing.  The  Navy  had  not  developed  any  corrective  action  plans  at 
the  time  that  it  incorrectly  concluded  that  its  civilian  pay  was  ready  for 
audit.  The  Air  Force  had  developed  some  plans  related  to  its  military 
equipment  weaknesses  but  not  for  all  deficiencies  identified,  and 
moreover,  it  had  not  implemented  any  of  the  corrective  actions  at  the 
time  that  it  stated  that  its  military  equipment  was  ready  for  audit.  Both 
components  stated  that  they  planned  to  complete  corrective  actions  in 
the  future. 

Because  of  the  deficiencies  we  identified,  neither  FIP  that  we  reviewed 
provided  sufficient  support  for  the  components’  conclusions  that  the 
balances  for  Navy  Civilian  Pay  and  Air  Force  Military  Equipment  were 
ready  for  audit.  Our  report  includes  recommendations  for  DOD  to  ensure 
that  components’  FIPs  comply  with  the  FIAR  Guidance.  Navy  officials 
stated  that  they  were  taking  action  to  address  the  issues  identified  and 
planned  to  submit  a  revised  FIP  by  March  2012.  Air  Force  officials  also 
indicated  that  they  were  taking  action  to  address  the  issues  identified. 


Marine  Corps  statement  of  After  DOD  established  budgetary  information  as  a  priority  in  its  FIAR 
Budgetary  Resources  Was  Plan,  the  Marine  Corps  was  identified  as  the  pilot  military  service  for  an 
Not  Auditable  audit  t*ie  SBR.  The  SBR  is  designed  to  provide  information  on 

authorized  budgeted  spending  authority  and  links  to  the  Budget  of  the 
United  States  Government  (President’s  Budget),  including  budgetary 
resources,  availability  of  budgetary  resources,  and  how  obligated 
resources  have  been  used.18  Because  the  Marine  Corps  is  a  military 
service  within  the  Department  of  the  Navy,  its  success  in  achieving  audit 
readiness  is  intended  to  pave  the  way  for  the  Navy  to  undergo  an  SBR 


18Budgetary  resources  include  the  amount  available  to  enter  into  new  obligations  and  to 
liquidate  them.  Budgetary  resources  are  made  up  of  new  budget  authority  (including  direct 
spending  authority  provided  in  existing  statute  and  obligation  limitations)  and  unobligated 
balances  of  budget  authority  provided  in  previous  years. 
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audit.  However,  the  DOD  IG  issued  a  disclaimer  of  opinion19  on  the 
Marine  Corps’  fiscal  year  2010  SBR  because  the  Marine  Corps  did  not 
provide  timely  and  relevant  supporting  documentation  for  accounting 
transactions  and  disbursements  in  key  areas,  which  prevented  the 
auditors  from  completing  the  audit  by  the  November  15,  2010,  reporting 
deadline.  In  addition,  the  auditors  reported  that  ineffective  internal  control 
and  ineffective  controls  in  key  financial  systems  should  be  addressed  to 
ensure  the  reliability  of  reported  financial  information.20  The  auditors 
identified  70  findings  and  made  139  recommendations  to  address  the 
issues.  Examples  of  the  problems  identified  include  the  following: 

•  The  DFAS  location  in  Cleveland,  Ohio,  (DFAS-CL) — which  performs 
accounting,  disbursing,  and  financial  reporting  services  for  the  Marine 
Corps — did  not  have  effective  procedures  in  place  to  ensure  that 
supporting  documentation  for  transactions  was  complete  and  readily 
available  to  pass  basic  audit  transaction  testing.  For  example,  the 
auditors  found  that  DFAS  staff  had  only  retained  selected  pages  of 
the  documents  supporting  payment  vouchers,  such  as  the  voucher 
cover  sheet,  and  did  not  have  the  purchase  order,  receiving  report, 
and  the  invoice  to  support  payments  made. 

•  The  Marine  Corps  did  not  have  effective  controls  in  place  to  support 
estimated  obligations,  referred  to  as  “bulk  obligations,”  to  record  a 
payment  liability,  and,  as  a  result,  was  not  able  to  reconcile  the  related 
payment  transactions  to  the  estimates.  The  Marine  Corps  estimates 
obligations  in  a  bulk  amount  to  record  payment  liabilities  where  it  does 
not  have  a  mechanism  to  identify  authorizing  documentation  as  a 
basis  for  recording  the  obligations. 

•  The  auditors  found  ineffective  controls  over  three  major  information 
technology  (IT)  systems  used  by  the  Marine  Corps  and  reported 


19ln  a  disclaimer  of  opinion,  the  auditor  does  not  express  an  opinion  on  the  financial 
statements.  A  disclaimer  of  opinion  is  appropriate  when  the  audit  scope  is  not  sufficient  to 
enable  the  auditor  to  express  an  opinion,  or  when  there  are  material  uncertainties 
involving  a  scope  limitation — a  situation  where  the  auditor  is  unable  to  obtain  sufficient 
appropriate  audit  evidence. 

20lnternal  control  comprises  the  plans,  methods,  and  procedures  to  provide  reasonable 
assurance  that  objectives  are  being  achieved  in  the  following  areas:  (1)  effectiveness  and 
efficiency  of  operations,  (2)  reliability  of  financial  reporting,  and  (3)  compliance  with 
applicable  laws  and  regulations. 
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numerous  problems  that  required  resolution.21  For  example,  the 
auditors  identified  a  lack  of  controls  over  interfaces  between  systems 
to  ensure  completeness  of  the  data  being  transferred.  System 
interface  controls  are  critical  for  ensuring  the  completeness  and 
accuracy  of  data  transferred  between  systems. 

Further,  in  addressing  the  70  audit  findings  and  related  139 
recommendations,  we  found  that  the  Marine  Corps  did  not  develop  an 
effective  overall  corrective  action  plan  that  identified  risks,  prioritized 
actions,  and  identified  required  resources  in  order  to  help  ensure  that 
actions  adequately  respond  to  recommendations.22  Instead,  its  approach 
to  addressing  auditor  findings  and  recommendations  for  its  prior  and 
current  audit  efforts  focuses  on  short-term  corrective  actions  necessary  to 
support  heroic  efforts  to  produce  reliable  financial  reporting  at  year-end. 
Such  efforts  may  not  result  in  sustained  improvements  over  the  long  term 
that  would  help  ensure  that  the  Marine  Corps  could  routinely  produce 
sound  data  on  a  timely  basis  for  decision  making.  While  the  Marine  Corps 
has  implemented  an  extensive  SBR  remediation  effort  that  is  focused  on 
individual  initiatives  to  address  the  70  audit  findings  and  139  related 
recommendations,  such  an  approach  could  result  in  inefficiencies  and 
ineffectiveness.  As  of  July  18,  2011,  the  Marine  Corps  reported  that 
actions  on  88  of  the  139  recommendations,  including  weaknesses  related 
to  accounting  and  financial  reporting  and  IT  systems,  were  fully 
implemented.  However,  the  completeness  and  effectiveness  of  the 
Marine  Corps’  actions  have  not  yet  been  tested.  DOD  IG  auditors  told  us 
that  tests  performed  during  the  Marine  Corps’  fiscal  year  201 1  SBR  audit 
effort  will  determine  whether  and  to  what  extent  the  problems  identified 
during  the  fiscal  year  2010  SBR  audit  effort  have  been  resolved.  They 
also  confirmed  that  as  of  August  25,  201 1 ,  the  Marine  Corps  had 
remediated  the  problems  on  11  of  the  IT  audit  recommendations. 


21The  three  systems  are  the  Marine  Corps  Total  Force  System  (MCTFS),  which  is  an 
integrated  military  personnel  and  payroll  system;  the  Standard  Accounting,  Budgeting, 
Reporting  System  (SABRS),  which  is  the  Marine  Corps’  general  ledger  accounting 
system;  and  the  Defense  Departmental  Reporting  System  (DDRS),  which  is  a  DOD-wide 
financial  reporting  system. 

22Some  of  these  elements  are  consistent  with  the  FIAR  Guidance  requirements  for  a 
corrective  action  plan,  such  as  identifying  required  resources  and  ensuring  that  actions 
address  the  identified  deficiencies. 
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Furthermore,  as  described  in  our  report  being  released  this  week,  we 
found  that  the  design  of  many  of  the  Marine  Corps  actions  relied  on 
monitoring,  a  detective  control;  high-level  initial  fixes  that  did  not  address 
root  causes;  and  other  actions  that  were  not  consistent  with  the  related 
auditors’  recommendations.23  For  example: 

•  Marine  Corps  remediation  actions  for  22  of  the  56  accounting  and 
financial  reporting  recommendations  rely  on  issuing  guidance, 
monitoring,  or  both,  in  an  attempt  to  quickly  address  identified 
weaknesses.  However,  correcting  underlying  causes  requires  process 
improvements  and  in  some  cases,  system  changes. 

•  Remediation  actions  for  20  of  the  139  recommendations  were  not 
consistent  with  the  related  recommendations.  For  example,  the 
auditors  identified  unliquidated  obligations  on  old  contracts  for  which 
performance  was  substantially  complete.  The  auditors  found  that  the 
Marine  Corps  did  not  have  an  effective  process  for  reviewing 
undelivered  orders  and  unliquidated  obligations,  and  recommended 
that  they  strengthen  these  controls,  whose  weaknesses  were  the  root 
cause  of  the  finding.  In  response,  Marine  Corps  officials  stated  that 
they  had  implemented  a  robust  review  process  for  validating 
obligations.  However,  the  auditors  reported  that  the  Marine  Corps 
developed  effective  written  procedures  but  found  problems  with  the 
implementation  of  those  procedures.  Thus,  the  Marine  Corps  did  not 
fully  address  the  recommendation  or  root  cause  of  the  problem. 

•  The  Marine  Corps  disagreed  with  six  auditor  recommendations  to 
strengthen  SABRS  system  controls  over  information  processing.  For 
example,  for  three  recommendations  related  to  password  and  log-on 
controls,  the  Marine  Corps  action  states  that  the  Defense  Information 
System  Agency  (DISA)  and  not  DFAS  is  responsible  for  the  actions. 
However,  Marine  Corps  officials  told  us  they  had  not  contacted  DISA 
officials  to  ensure  that  they  would  address  the  recommendations. 

Our  report  includes  recommendations  to  the  Secretary  of  the  Navy  to 
direct  the  Marine  Corps  to  develop  a  comprehensive,  risk-based 
corrective  action  plan,  confirm  that  corrective  actions  fully  address  auditor 
findings,  and  work  more  closely  with  service  providers,  such  as  DFAS,  to 
clarify  their  roles  and  responsibilities  on  corrective  actions  that  require 


23GAO-1 1-830. 
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cross-component  work.  In  commenting  on  our  report,  the  Navy  said  that  it 
is  working  to  address  the  auditor-identified  deficiencies.  Further  details  on 
the  Navy’s  comments  and  our  evaluation  of  them  can  be  found  in  our 
report. 


Issues  with  Navy  and 
Marine  Corps  Processes 
for  Reconciling  Fund 
Balance  with  Treasury 
(FBWT) 


Reconciling  the  FBWT  account  is  a  key  financial  management  control. 
FBWT  is  an  asset  account  that  reflects  the  available  budget  spending 
authority  of  federal  agencies.  Reconciling  a  FBWT  account  with  Treasury 
records  is  a  process  similar  in  concept  to  reconciling  a  check  book  with  a 
bank  statement.  However,  within  the  large,  complex  DOD  environment, 
the  FBWT  reconciliation  involves  reconciliations  between  several  different 
systems,  such  as  the  DOD  components’  general  ledgers,  the  DOD-wide 
general  ledger,  DOD’s  cash  accountability  system,  and  Treasury  records. 
FBWT  reconciliations  are  a  key  internal  control  for  ensuring  that  all 
receipt  and  disbursement  transactions  have  been  properly  recorded  in 
federal  agency  accounting  records.  Effective  fund  balance  reconciliations 
serve  as  a  detective  control  for  identifying  unauthorized  and  unrecorded 
transactions  at  a  federal  agency  or  at  the  U.S.  Treasury. 

A  successful  audit  of  the  SBR  is  dependent  on  an  auditable  FBWT,  which 
includes  the  ability  to  reconcile  the  FBWT  account  with  the  Treasury 
records.  However,  our  preliminary  work  has  identified  issues  with  the 
Navy  and  Marine  Corps’  implementation  of  effective  processes  for 
reconciling  their  FBWT,  including  issues  related  to  financial  management 
systems  and  certain  policies  and  procedures,  training,  and  supervisory 
review  and  approval.  For  example: 

•  DOD  has  not  tested  application  controls  over  the  Defense  Cash 
Accountability  System  (DCAS) — the  department’s  system  of  record  for 
all  cash  activity.  Navy,  Marine  Corps,  and  DFAS  officials  stated  that 
they  have  identified  over  650  system  deficiencies  that  affect  DCAS 
data  reliability,  and  that  over  200  of  the  identified  deficiencies  affect 
audit  readiness.  They  identified  the  top  20  deficiencies  that  require 
immediate  attention;  however,  they  stated  that  a  time  frame  for 
addressing  these  top  20  issues  had  not  yet  been  established. 

•  DFAS  did  not  maintain  adequate  documentation  for  the  sample  of 
items  we  tested  to  enable  an  independent  evaluation  of  its  efforts  to 
research  and  resolve  differences. 

•  Navy  and  DFAS  policies  and  procedures  did  not  contain  detailed 
information  on  the  roles  and  responsibilities  of  organizations  and 
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personnel  and  the  process  for  identifying,  researching,  and  resolving 
discrepancies,  including  maintaining  required  supporting 
documentation.  The  policies  and  procedures  also  did  not  require 
supervisory  review  and  approval  of  reconciliation  efforts  and  results. 

Navy,  Marine  Corps,  and  DFAS  officials  acknowledged  that  existing 
policies  and  procedures  are  inadequate.  They  also  stated  that  the  base 
realignment  and  closure  changes  in  2006  through  2008  resulted  in  a  loss 
of  experienced  DFAS-CL  personnel  and  that  the  remaining  staff  have  not 
received  the  needed  training.  Navy  officials  stated  that  they  are  currently 
developing  a  Plan  of  Actions  and  Milestones  (POAM)  to  address 
weaknesses  that  affect  the  Navy  and  Marine  Corps’  audit  readiness, 
including  reconciling  FBWT  records. 

We  will  report  more  fully  on  these  issues,  including  actions  DOD  is  taking 
to  address  them,  in  our  forthcoming  report. 


Issues  with 

Implementation  of  Two  of 
DOD’s  Enterprise 
Resource  Planning  (ERP) 
Systems 


The  implementation  of  an  integrated,  audit-ready  systems  environment 
through  the  deployment  of  ERP  systems  underlies  all  of  DOD’s  financial 
improvement  efforts  and  is  crucial  to  achieving  departmentwide  audit 
readiness.  According  to  DOD,  the  successful  implementation  of  the  ERPs 
is  not  only  critical  for  addressing  long-standing  weaknesses  in  financial 
management,  but  equally  important  for  helping  to  resolve  weaknesses  in 
other  high-risk  areas  such  as  business  transformation,  business  system 
modernization,  and  supply  chain  management.  Successful 
implementation  will  support  DOD  by  standardizing  and  streamlining  its 
financial  management  and  accounting  systems,  integrating  multiple 
logistics  systems  and  finance  processes,  providing  asset  visibility  for 
accountable  items,  and  integrating  personnel  and  pay  systems. 
Previously,  we  reported  that  delays  in  the  successful  implementation  of 
ERPs  have  extended  the  use  of  existing  duplicative,  stovepiped  systems, 
and  have  continued  the  funding  of  these  systems  longer  than 
anticipated.24  To  the  degree  that  these  business  systems  do  not  provide 
the  intended  capabilities,  DOD’s  goal  of  departmentwide  audit  readiness 
by  the  end  of  fiscal  year  201 7  could  be  jeopardized. 


24GAO,  DOD  Business  Transformation:  Improved  Management  Oversight  of  Business 
System  Modernization  Efforts  Needed,  GAO-11-53  (Washington,  D.C.:  Oct.  7,  2010). 
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Over  the  years,  we  have  reported  that  DOD  has  not  effectively  employed 
management  controls  to  ensure  that  the  development  and  implementation 
of  ERPs  deliver  the  promised  capabilities  on  time  and  within  budget.  As 
we  reported  in  October  2010,  DOD  has  identified  10  ERPs — 1  of  which 
had  been  fully  implemented — as  essential  to  its  efforts  to  transform  its 
business  operations.25  We  are  currently  reviewing  the  status  of  two  of 
these  ERPs — the  Army’s  General  Fund  Enterprise  Business  System 
(GFEBS)  and  the  Air  Force’s  Defense  Enterprise  Accounting  and 
Management  System  (DEAMS).  GFEBS  is  intended  to  support  the 
Army’s  standardized  financial  management  and  accounting  practices  for 
the  Army’s  general  fund,  except  for  funds  related  to  the  Army  Corps  of 
Engineers.  The  Army  estimates  that  GFEBS  will  be  used  to  control  and 
account  for  approximately  $140  billion  in  annual  spending.  DEAMS  is 
intended  to  provide  the  Air  Force  with  the  entire  spectrum  of  financial 
management  capabilities  and  is  expected  to  maintain  control  and 
accountability  for  approximately  $160  billion.  GFEBS  is  expected  to  be 
fully  deployed  during  fiscal  year  2012,  is  currently  operational  at  154 
locations,  including  DFAS,  and  is  being  used  by  approximately  35,000 
users.  DEAMS  is  expected  to  be  fully  deployed  during  fiscal  year  2016,  is 
currently  operational  at  Scott  Air  Force  Base  and  DFAS,  and  is  being 
used  by  about  1 ,100  individuals. 

Our  preliminary  results  identified  issues  related  to  GFEBS  and  DEAMS 
providing  DFAS  users  with  the  expected  capabilities  in  accounting, 
management  information,  and  decision  support.  To  compensate,  DFAS 
users  have  devised  manual  workarounds  and  several  applications  to 
obtain  the  information  they  need  to  perform  their  day-to-day  tasks.  The 
Army  and  Air  Force  have  stated  that  they  have  plans  to  address  these 
issues,  and  the  Army  has  plans  to  validate  the  audit  readiness  of  GFEBS 
in  a  series  of  independent  auditor  examinations  over  the  next  several 


25GAO-1 1-53.  The  10  ERPs  are  as  follows:  Army — General  Fund  Enterprise  Business 
System  (GFEBS),  Global  Combat  Support  System-Army  (GCSS-Army),  and  Logistics 
Modernization  Program  (LMP);  Navy — Navy  Enterprise  Resource  Planning  (Navy  ERP)  and 
Global  Combat  Support  System-Marine  Corps  (GCSS-MC);  Air  Force — Defense  Enterprise 
Accounting  and  Management  System  (DEAMS)  and  Expeditionary  Combat  Support  System 
(ECSS);  Defense — Service  Specific  Integrated  Personnel  and  Pay  Systems  and  Defense 
Agencies  Initiative  (DAI);  and  Defense  Logistics  Agency — Business  System  Modernization 
(BSM).  According  to  DOD,  BSM  was  fully  implemented  in  July  2007. 
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fiscal  years.  For  DEAMS,  the  DOD  Milestone  Decision  Authority26  (MDA) 
has  directed  that  the  system  is  not  to  be  deployed  beyond  Scott  Air  Force 
Base  until  the  known  system  weaknesses  have  been  corrected  and  the 
system  has  been  independently  tested  to  ensure  that  it  is  operating  as 
intended.  Examples  of  the  issues  in  these  systems  that  DFAS  users  have 
identified  include  the  following: 

GFEBS 

•  The  backlog  of  unresolved  GFEBS  trouble  tickets  has  continued  to 
increase  from  about  250  in  September  2010  to  approximately  400  in 
May  2011.  Trouble  tickets  represent  user  questions  and  issues  with 
transactions  or  system  performance  that  have  not  been  resolved. 
According  to  Army  officials,  this  increase  in  tickets  was  not 
unexpected  since  the  number  of  users  and  the  number  of  transactions 
being  processed  by  the  system  has  increased,  and  the  Army  and 
DFAS  are  taking  steps  to  address  issues  raised  by  DFAS. 

•  Approximately  two-thirds  of  invoice  and  receipt  data  must  be  manually 
entered  into  GFEBS  from  the  invoicing  and  receiving  system  (i.e. , 
Wide  Area  Work  Flow).27  DFAS  personnel  stated  that  manual  data 
entry  will  eventually  become  infeasible  due  to  increased  quantities  of 
data  that  will  have  to  be  manually  entered  as  GFEBS  is  deployed  to 
additional  locations.  Army  officials  acknowledged  that  there  is  a 
problem  with  the  Wide  Area  Work  Flow  and  GFEBS  interface  and  that 
this  problem  reduced  the  effectiveness  of  GFEBS,  and  that  they  are 
working  with  DOD  to  resolve  the  problem. 

•  GFEBS  lacks  the  ability  to  run  ad  hoc  queries  or  search  for  data  in  the 
system  to  resolve  problems  or  answer  questions.28  The  Army  has 


26The  Milestone  Decision  Authority  is  the  senior  DOD  official  who  has  overall  authority  to 
approve  entry  of  an  acquisition  program  into  the  next  phase  of  the  acquisition  process  and 
is  accountable  for  cost,  schedule,  and  performance  reporting,  including  congressional 
reporting. 

270ffice  of  Federal  Financial  Management,  Core  Financial  System  Requirements 
(Washington,  D.C.:  January  2006)  states  that  a  Core  financial  system  must  deliver 
workflow  capabilities  including  integrated  workflow,  workflow  process  definition  and 
processing  exception  notices. 

280ffice  of  Federal  Financial  Management,  Core  Financial  System  Requirements  state  a 
Core  financial  system  must  provide  an  integrated  ad  hoc  query  capability  to  support 
agency  access  to  and  analysis  of  system-maintained  financial  data. 
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recognized  this  limitation  and  is  currently  developing  a  system 
enhancement  that  they  expect  will  better  support  the  users’  needs. 


DEAMS 

•  Manual  workarounds  are  needed  to  process  certain  accounts 
receivable  transactions  such  as  travel  debts.  DFAS  personnel  stated 
that  the  problem  is  the  result  of  the  data  not  being  properly  converted 
from  the  legacy  systems  to  DEAMS. 

•  DFAS  officials  indicated  that  they  were  experiencing  difficulty  with 
some  of  the  DEAMS  system  interfaces.29  For  example,  the  interface 
problem  with  the  Standard  Procurement  System  has  become  so 
severe  that  the  interface  has  been  turned  off,  and  the  data  must  be 
manually  entered  into  DEAMS. 

•  DFAS  officials  stated  that  DEAMS  does  not  provide  the  capability — 
which  existed  in  the  legacy  systems — to  produce  ad  hoc  reports  that 
can  be  used  to  perform  the  data  analysis  needed  to  perform  daily 
operations.30  They  also  noted  that  when  some  reports  are  produced, 
the  accuracy  of  those  reports  is  questionable. 

DFAS  users  also  told  us  that  the  training  they  received  focused  more  on 
how  GFEBS  and  DEAMS  were  supposed  to  operate,  rather  than 
providing  DFAS  personnel  training  about  how  to  use  these  systems  to 
perform  their  day-to-day  operations.  The  Army  acknowledged  that  from  a 
DFAS  perspective,  the  training  should  have  shown  DFAS  how  they  could 
use  GFEBS  to  perform  tasks  such  as  the  reconciliation  of  accounts.  To 
help  address  this  training  issue,  DFAS  is  in  the  process  of  developing 
courses  and  desk  guides  suitable  for  DFAS  employees  who  use  GFEBS 
and  DEAMS  on  a  day-to-day  basis. 


290ffice  of  Federal  Financial  Management,  Core  Financial  System  Requirements  state 
that  a  Core  financial  system  financial  transactions  can  be  originated  using  multiple 
external  feeder  applications.  These  feeder  systems  and  the  Core  financial  system  must 
interface  seamlessly  so  that  data  can  move  effectively  between  them.  The  Core  system 
must  be  able  to  process  and  validate  the  data  independent  of  origination.  There  must  also 
be  a  process  for  handling  erroneous  input  and  correction. 

30Office  of  Federal  Financial  Management,  Core  Financial  System  Requirements  state 
that  a  Core  financial  system  financial  transactions  must  deliver  an  integrated  ad  hoc  query 
capability  to  support  agency  access  to  and  analysis  of  system  maintained  financial  data. 
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We  will  report  more  fully  on  these  issues,  including  DOD’s  actions  to 
address  them,  in  our  forthcoming  report. 

Improved  Monitoring 
and  Oversight  of 
Component  Financial 
Improvement  Plans 
(FIP)  Are  Needed 

In  one  report  we  issued  this  week,  we  found  that  weaknesses  in  the  Navy 
and  Air  Force  FIAR  Plan  implementation  efforts  indicate  that  the 
monitoring  and  oversight  of  such  efforts  have  not  been  effective.31 
Although  we  found  that  DOD  and  its  military  components  had  established 
appropriate  organizational  structures  for  monitoring  and  oversight  of  audit 
readiness  efforts,  oversight  responsibilities  were  not  always  effectively 
carried  out.  Both  DOD  and  the  components  have  established  senior 
executive  committees  as  well  as  designated  officials  at  the  appropriate 
levels  to  monitor  and  oversee  their  financial  improvement  efforts.  These 
committees  and  individuals  have  also  generally  been  assigned 
appropriate  roles  and  responsibilities.  However,  we  found  that  component 
officials  as  well  as  the  oversight  committees  at  both  the  component  and 
DOD  levels  did  not  effectively  carry  out  their  monitoring  responsibilities  for 
the  Navy  Civilian  Pay  and  Air  Force  Military  Equipment  FIPs.  Specifically, 
for  these  two  FIPs  that  we  reviewed,  neither  individual  officials  nor  the 
executive  committees  took  sufficient  action  to  ensure  that  the  FIPs  were 
accurate  or  complied  with  the  FIAR  Guidance.  As  a  result,  the  Navy 
concluded  that  its  civilian  pay  was  ready  for  audit,  as  did  the  Air  Force 
with  respect  to  its  military  equipment,  even  though  they  did  not  have 
sufficient  support  to  assert  audit  readiness. 

On  the  other  hand,  once  the  Navy  and  Air  Force  submitted  the  FIPs  to 
DOD  in  support  of  their  audit  readiness  assertions,  both  the  DOD  IG  and 
the  DOD  Comptroller  carried  out  their  responsibilities  for  reviewing  the 
FIPs.  In  their  reviews,  both  organizations  identified  issues  with  the  FIPs 
that  were  similar  to  those  we  had  identified.  The  DOD  Comptroller,  who 
makes  the  final  determination  as  to  whether  an  assessable  unit  is  ready 
for  audit,  concluded  that  neither  of  these  FIPs  supported  audit  readiness. 

Effective  oversight  and  monitoring  would  also  help  ensure  that  lessons 
learned  from  recent  efforts  would  be  sufficiently  disseminated  throughout 
the  department  and  applied  to  other  financial  improvement  efforts.  In 
commenting  on  our  report  about  the  FIPs,  the  DOD  Comptroller  stated 
that  it  is  critical  that  the  department  continues  to  look  at  how  effectively  it 

31GAO-1 1-851. 
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applies  lessons  learned.  For  example,  the  results  of  the  Marine  Corps’ 
SBR  audit  effort  provide  valuable  lessons  on  preparing  for  a  first-time 
financial  statement  audit.  As  we  recently  testified,  lessons  learned  from 
this  audit  effort  can  provide  a  roadmap  to  help  other  DOD  components 
achieve  audit  readiness.32  While  this  audit  effort  provided  numerous 
issues  for  the  other  military  services  to  consider  in  their  audit  readiness 
efforts,  we  identified  and  reported  on  five  overall  lessons  that  are  critical 
to  success.33  Specifically,  the  Marine  Corps’  SBR  experience 
demonstrated  that  prior  to  asserting  financial  statement  audit  readiness, 
DOD  components  must  be  able  to  perform  the  following  procedures; 

•  Confirm  completeness  of  populations  of  transactions  and 
address  any  abnormal  transactions  and  balances.  The  Marine 
Corps  SBR  auditors  made  multiple  requests  for  transaction-level 
detail  for  key  SBR  accounts.  Navy  officials  told  us  that  they  identified 
problems  with  the  way  transactions  map  to  general  ledger  accounts, 
which  makes  it  difficult  to  identify  transaction  populations.  Navy 
officials  noted  that  these  problems  impeded  the  Marine  Corps  SBR 
audit  effort  and  also  prevent  the  reconciliation  of  Unadjusted  to 
Adjusted  Trial  Balances,  FBWT  reconciliations,  and  overall  funds 
control. 

•  Test  beginning  balances.  A  first-year  SBR  audit  requires  substantial 
testing  to  confirm  beginning  balances.  Navy  officials  noted  that  earlier 
audit  readiness  efforts  were  not  sufficient  to  confirm  beginning 
balances,  and  problems  identified  with  the  assignment  of  general 
ledger  account  numbers  and  mapping  of  transactions  to  the  proper 
accounts  will  need  to  be  resolved  to  ensure  the  auditability  of 
beginning  balances. 

•  Perform  key  reconciliations.  The  Marine  Corps  did  not  have 
processes  in  place  to  reconcile  key  accounts  such  as  FBWT.  In 
addition,  the  Marine  Corps  had  to  make  repeated  attempts  before  it 
could  reconcile  the  Unadjusted  Trial  Balance  to  the  Adjusted  Trial 
Balance.  This  reconciliation  is  an  important  step  to  verify  that  the  SBR 
is  accurate. 


32GAO,  DOD  Financial  Management:  Numerous  Challenges  Must  Be  Addressed  to 
Improve  Reliability  of  Financial  Information,  GAO-1 1-835T  (Washington,  D.C.:  July  27, 
2011). 

33GAO-1 1-830. 
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•  Provide  timely  and  complete  response  to  audit  documentation 
requests.  The  auditors  reported  that  the  Marine  Corps,  through  its 
service  provider,  DFAS,  did  not  consistently  provide  timely  and 
accurate  audit  documentation.  Without  such  documentation,  the 
auditors  were  unable  to  determine  whether  a  given  transaction  was 
authorized,  whether  the  goods  or  services  were  received,  whether  the 
invoice  was  approved  for  payment,  or  whether  the  funds  disbursed 
were  correct. 

•  Verify  that  key  IT  systems  are  compliant  and  auditable.34  The 

auditors  informed  the  Marine  Corps  of  numerous  control  weaknesses 
they  identified  in  key  systems,  including  some  DOD-wide  systems, 
which  affected  auditability.  The  auditability  of  key  systems,  including 
military  payroll  systems,  accounting  systems,  and  financial  reporting 
systems,  is  essential  to  achieving  and  sustaining  an  audit  opinion. 

These  five  critical  lessons  from  the  Marine  Corps  SBR  audit  effort  are  all 
addressed  in  the  FIAR  Guidance  as  procedures  that  must  be  performed 
before  an  assessable  unit  can  be  considered  ready  for  audit.  As  the 
Army,  Navy,  and  Air  Force  move  forward  in  developing  and  implementing 
their  FIPs,  in  our  report  we  recommend  that  they  take  into  account  the 
lessons  learned  during  the  course  of  pilot  audit  efforts,  such  as  the 
Marine  Corps  SBR.  Navy  financial  management  officials  indicated  that 
they  are  aware  of  the  Marine  Corps  lessons  and  that  they  are  updating 
their  audit  readiness  plan  to  address  all  five  critical  lessons.  Army  and  Air 
Force  officials  indicated  their  awareness  of  some  of  these  findings  but 
only  provided  information  on  their  efforts  regarding  FBWT  reconciliations 
and  ERP  implementations.  As  noted  above,  DOD  generally  agreed  with 
the  need  to  effectively  communicate  lessons  learned  among  its 
components.  Our  report  more  fully  describes  DOD’s  comments  and  our 
evaluation  of  them. 


34DOD  financial  management  systems  are  required  by  the  Federal  Financial  Management 
Improvement  Act  of  1996  (FFMIA)  to  comply  with  federal  financial  management  systems 
requirements,  applicable  federal  accounting  standards,  and  the  United  States  Government 
Standard  General  Ledger  at  the  transaction  level.  Pub.  L.  No.  104-208,  div.  A,  title  VIII,  § 
803,  1 1 0  Stat.  3009,  3009-390  (Sept.  30,  1 996). 
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Concluding 

Observations 


With  the  FIAR  Plan  and  related  FIAR  Guidance,  DOD  has  established  a 
reasonable  strategy  and  methodology  for  improving  its  financial 
management.  However,  it  faces  considerable  implementation  challenges 
and  has  much  work  to  do  if  it  is  to  meet  the  goal  of  audit  readiness  by  the 
end  of  fiscal  year  2017.  These  challenges,  as  we  have  previously 
testified,  include  (1)  maintaining  committed  and  sustained  leadership;  (2) 
developing  and  implementing  an  effective  plan  to  correct  internal  control 
weaknesses;  (3)  establishing  accountability  and  effective  oversight  to 
monitor  progress;  and  (4)  successfully  implementing  ERP  systems 
consistent  with  an  effective  corporate  enterprise  architecture.35  It  is  critical 
that  DOD’s  current  initiatives  be  continued  and  provided  with  sufficient 
resources.  Oversight  and  monitoring  will  also  play  a  key  role  in  ensuring 
that  DOD’s  plans  are  implemented  as  intended  and  that  lessons  learned 
are  identified  and  effectively  disseminated.  Absent  continued  momentum 
and  necessary  future  investments,  the  current  initiatives  may  falter, 
similar  to  previous  efforts.  Continued  congressional  oversight  will  be  an 
important  factor  in  helping  to  ensure  the  department’s  success. 


Chairman  Carper,  Ranking  Member  Brown,  and  members  of  the 
Subcommittee,  this  completes  my  prepared  statement.  I  would  be 
pleased  to  respond  to  any  questions  that  you  may  have  at  this  time. 
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35GAO-1 1-835T. 
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